PCI Compliance Does Not Equal Security

An article about the top 10 security breaches of 2008, cited that 2 out of the 10 breaches were done to companies who were in compliance with PCI regulations. 

Both Maine-based Hannaford Brothers grocery store chain and ski resort Okemo were hit by hackers that installed malicious software on their Websites to capture credit card data.  And at the time of both attacks, the companies were PCI compliant.  These firms now share company with the likes of Forever 21 – a retail clothing company – that was victim to a similar attack back in October.

I liked how the author summarized PCI compliance: 

Lesson Learned:  PCI compliance is like a driver's license -- it may mean that a retailer has passed the test for compliance, but doesn't necessarily mean it is in compliance.

At the risk of sounding redundant, we will stress again, that companies must do more that just attain PCI compliance.  They must constantly test and re-test their Websites for the latest vulnerability threats, as 400 new ones emerge every month.

by
Erin Swanson
Eswanson@cenzic.com